ffuf
Basics :
Finding pages and directories
ffuf -u http://10.10.210.77/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txtFor example, we can append the extension after index. head /usr/share/seclists/Discovery/Web-Content/web-extensions.txt .asp .aspx .bat .c .cfm .cgi .css .com .dll .exe
ffuf -u http://10.10.210.77/indexFUZZ -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txtffuf -u http://10.10.210.77/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -e .php,.txt[+]Directory names are not always dependent on the type of environment you are enumerating and is often a good starting point before attempting to fuzz for files. If we wanted to fuzz directories we only need to provide a wordlist.
ffuf -u http://10.10.210.77/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txtUsing filters
ffuf -u http://10.10.210.77/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -fc 403ffuf -u http://10.10.210.77/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -mc 200Sometimes it might be beneficial to see what requests the server doesn't handle by matching for HTTP 500 Internal Server Error response codes (-mc 500). Finding irregularities in behavior could help better understand how the web app works.
There are other filters and matchers. For example, you could encounter entries with a 200 status code with a response size of zero. eg. functions.php or inc/myfile.php.
$ ffuf -u http://10.10.210.77/config/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -fc 403
...
. [Status: 200, Size: 1165, Words: 76, Lines: 18]
config.inc.php [Status: 200, Size: 0, Words: 1, Lines: 1]
:: Progress: [16243/16243] :: Job [1/1] :: 1732 req/sec :: Duration: [0:00:13] :: Errors: 0 ::Unless we have a LFI (local file inclusion) this kind of files aren't interesting, so we can use -fs 0 (filter size). Here are all filters and matchers:
$ ffuf -h
...
MATCHER OPTIONS:
-mc Match HTTP status codes, or "all" for everything. (default: 200,204,301,302,307,401,403,405)
-ml Match amount of lines in response
-mr Match regexp
-ms Match HTTP response size
-mw Match amount of words in response
FILTER OPTIONS:
-fc Filter HTTP status codes from response. Comma separated list of codes and ranges
-fl Filter by amount of lines in response. Comma separated list of line counts and ranges
-fr Filter regexp
-fs Filter HTTP response size. Comma separated list of sizes and ranges
-fw Filter by amount of words in response. Comma separated list of word counts and ranges
...We often see there are false positives with files beginning with a dot (eg. .htgroups, .php, etc.). They throw a 403 Forbidden error, however those files don't actually exist. It's tempting to use -fc 403 but this could hide valuable files we don't have access to yet. So instead we can use a regexp to match all files beginning with a dot.
ffuf -u http://10.10.210.77/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -fr '/\..*'
Fuzzing parameters
ffuf -k -u https://watch.streamio.htb/search.php -d "q=FUZZ" -w /usr/share/sectists/specialchars.txt -H 'Content-type: []'For this task, we'll be looking at parameter fuzzing. This is the base URL we'll be fuzzing: http://MACHINE_IP/sqli-labs/Less-1/.
What would you do when you find a page or API endpoint but don't know which parameters are accepted? You fuzz!
Discovering a vulnerable parameter could lead to file inclusion, path disclosure, XSS, SQL injection, or even command injection. Since ffuf allows you to put the keyword anywhere we can use it to fuzz for parameters.
ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 39ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -fw 39Now that we found a parameter accepting integer values we'll start fuzzing values.
At this point, we could generate a wordlist and save a file containing integers. To cut out a step we can use -w - which tells ffuf to read a wordlist from stdout. This will allow us to generate a list of integers with a command of our choice then pipe the output to ffuf. Below is a list of 5 different ways to generate numbers 0 - 255.
ruby -e '(0..255).each{|i| puts i}' | ffuf -u 'http://10.10.94.46/sqli-labs/Less-1/?id=FUZZ' -c -w - -fw 33
ruby -e 'puts (0..255).to_a' | ffuf -u 'http://10.10.94.46/sqli-labs/Less-1/?id=FUZZ' -c -w - -fw 33
for i in {0..255}; do echo $i; done | ffuf -u 'http://10.10.94.46/sqli-labs/Less-1/?id=FUZZ' -c -w - -fw 33
seq 0 255 | ffuf -u 'http://10.10.94.46/sqli-labs/Less-1/?id=FUZZ' -c -w - -fw 33
cook '[0-255]' | ffuf -u 'http://10.10.94.46/sqli-labs/Less-1/?id=FUZZ' -c -w - -fw 33We can also use ffuf for wordlist-based brute-force attacks, for example, trying passwords on an authentication page.
ffuf -u http://MACHINE_IP/sqli-labs/Less-11/ -c -w /usr/share/seclists/Passwords/Leaked-Databases/hak5.txt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=Submit' -fs 1435 -H 'Content-Type: application/x-www-form-urlencoded'Here we have to use the POST method (specified with -X) and to give the POST data (with -d) where we include the FUZZ keyword in place of the password.
We also have to specify a custom header -H 'Content-Type: application/x-www-form-urlencoded' because ffuf doesn't set this content-type header automatically as curl does.
Finding vhosts and subdomains
ffuf may not be as efficient as specialized tools when it comes to subdomain enumeration but it's possible to do.
ffuf -u http://FUZZ.mydomain.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txtSome subdomains might not be resolvable by the DNS server you're using and are only resolvable from within the target's local network by their private DNS servers. So some virtual hosts (vhosts) may exist with private subdomains so the previous command doesn't find them. To try finding private subdomains we'll have to use the Host HTTP header as these requests might be accepted by the web server. Note: virtual hosts (vhosts) is the name used by Apache httpd but for Nginx the right term is Server Blocks.
You could compare the results obtained with direct subdomain enumeration and with vhost enumeration:
ffuf -u http://FUZZ.mydomain.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0
ffuf -u http://mydomain.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H 'Host: FUZZ.mydomain.com' -fs 0For example, it is possible that you can't find a sub-domain with direct subdomain enumeration (1st command) but that you can find it with vhost enumeration (2nd command).
Vhost enumeration technique shouldn't be discounted as it may lead to discovering content that wasn't meant to be accessed externally.
Proxifying ffuf traffic
Whether it's for network pivoting or for using BurpSuite plugins you can send all the ffuf traffic through a web proxy (HTTP or SOCKS5).
ffuf -u http://10.10.94.46/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt -x http://127.0.0.1:8080It's also possible to send only matches to your proxy for replaying:
$ ffuf -u http://10.10.94.46/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt -replay-proxy http://127.0.0.1:8080This may be useful if you don't need all the traffic to traverse an upstream proxy and want to minimize resource usage or to avoid polluting your proxy history.
Reviewing the options
As you start to use ffuf more, some options will prove to be very useful depending on your situation.-ic allows you to ignore comments in wordlists that such as headers, copyright notes, comments, etc:
head /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt ffuf -u http://10.10.94.46/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -fs 0We've only reviewed a small subset of the useful features and options ffuf has to offer for fuzzing. Use ffuf -h to discover the other options that might be useful for you and to answer the remaining questions in this task.
Last updated